linux-kernel - Re: 6.1rc1: NFS memcpy warning on mount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202210162113.1A948FEAB@keescook>
Date:   Sun, 16 Oct 2022 21:17:45 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Bagas Sanjaya <bagasdotme@...il.com>
Cc:     Dave Jones <davej@...emonkey.org.uk>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-nfs@...r.kernel.org, linux-hardening@...r.kernel.org,
        Trond Myklebust <trond.myklebust@...merspace.com>,
        Scott Mayhew <smayhew@...hat.com>,
        Anna Schumaker <anna@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: 6.1rc1: NFS memcpy warning on mount

On Mon, Oct 17, 2022 at 10:58:55AM +0700, Bagas Sanjaya wrote:
> On Sun, Oct 16, 2022 at 10:58:21PM -0400, Dave Jones wrote:
> > Started getting this during mount on a 6.1rc1 kernel..
> > not sure which mount it's complaining about, but they're all v3 tcp
> > mounts on that machine.
> > 
> > [   19.617475] memcpy: detected field-spanning write (size 28) of single field "request.sap" at fs/nfs/super.c:857 (size 18446744073709551615)
> [...]
> Hmm, the blamed line in the warning is introduced by 38465f5d1af932 ("NFS:
> rename nfs_fs_context pointer arg in a few functions"). Cc: the commit
> author. Also Cc: Kees for authoring the patch [1] that have fixed
> similar warning.

The warning is from commit 54d9469bc515 ("fortify: Add run-time WARN
for cross-field memcpy()")

> Also, does v6.0 have this warning? If so, you need to bisect in the range
> of v6.0..v6.1-rc1.

No need for bisection -- this is almost certainly a false positive (as
detailed in the above commit: we're working on purging all of these
cases from the kernel).

> [1]: https://lore.kernel.org/lkml/20221011065243.583650-1-keescook@chromium.org/

Yeah, I have a v2 of this patch, which should also fix this request.sap
issue. Sending shortly...

-- 
Kees Cook